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Virus Outbreak Detected 
Execute Step 1 
Confirm Step 2 
Execute Step 2 
Execute Step 3 
Execute Step 4 
Confirm Step 5 
Execute Step 5 



Legend: 

Predefined Actions To Be Followed Upon Detection of Outbreak 

Such actions may optionally include: 

1 . Reducing virus detection notification; 

2. Switching from virus quarantining to virus deletion when a computer 
virus is detected; 

3. Increasing scan options that control how thoroughly the computer 
system is scanned to detect a computer virus; 

4. Sending a copy of the detected computer virus to a remote site for 
analysis; 

5. Downloading a latest virus definition file from a remote site; 

6. Performing a complete virus scan of all computer files stored in at 
least a portion of the computer apparatus; 

7. Blocking e-mail attachments to block identical attachments appearing 
in excess of a threshold level; 

8. Rendering non-accessible e-mail distribution lists and e-mail address 
books of e-mail clients coupled to the computer apparatus; 

9. Restarting in administrator mode an e-mail post office coupled to the 
computer apparatus; and 

10. Closing down an e-mail post office coupled to the computer 
apparatus. 




Escalation time 1 

Escalation time 2 

Escalation time 3 
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Network Associates Emergency Response 0 



Apply rules in the following order: 



Outbreak response stage 1 
Outbreak response stage 2 



New 



Copy 



Modify 



Rename 



Delete 



Move Up 



Move Down 



Event description (click on an underlined value to edit it) 



OK 



Cancel 
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Emergency Response Event 




Which type of event do you wish to create? 



Number of Identical Attachment types in a Time Period 
Number of Identical Attachments in a Time Period 
Number of Identical Viruses in a Time Period 



Number of Viruses in a Time Period 



L 



Event description (click on an underlined value to edit it) 



Number of virus(es) in 1 hours 20 minutes 



<Back | Next> ~\ \ Cancel ~ | Help 
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Number 



El 



Please enter the new numeric value 



5| 



OK 



Cancel 



Time 



m 



Please enter the new time value 
Hour(s): Minute(s) 



El 



20 



El 
El 



OK 



Cancel 
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Emergency Response Event 




Which type of reaction do you wish for this event? 

0 Manual 
O Automatic 



□ Notify by email 

□ Notify by network broadcast 

□ Notify by pager 



Reaction description (click on an underlined value to edit it) 



React manually to an emergency response but notify me 
via email address email address 



| <Back | Next> | | Cancel "" | Help 
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Number 
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Please enter the new numeric value : 




30284235551 1 1 












OK | 


Cancel | 
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Email Address 
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Please enter the new email address : 




a@a.com 












OK | 


Cancel | 
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Machine name 
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Please enter the new machine name : 






AYL-NOBODY || ... | 










OK 




Cancel | 
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Out of office hours 



Please enter the out of office hours : 

Day Am Noon 



1; 



Monday 



Tuesday 



Wednesday 



Thursday 



Friday 
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9 


10 


11 


12 


1 
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Saturday 



Sunday 



Sunday - 7 am 



OK 



Cancel 
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Emergency Response Event 




Specify the actions and step to carry out: 



Step | Action 



| Escalation Time \ 



0 Update DAT files (GroupShield Exc. 

1 Reduce notifications (GroupShield 



0 hr(s) 1 min(s) 
0 hr(s) 10 min(s) 



Move Up 



Move Down 



Add 



Remove 



□ Create an emergency response report 



<Back | Next> [ 



Cancel 



| Help 
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Available Actions 



m 



| Action 



Component 



GroupShield Exchange 



GroupShield 
GroupShield 
GroupShield 
GroupShield 
GroupShield 
GroupShield 



Exchange 
Exchange 
Exchange 
Exchange 
Exchange 
Exchange 



Delete on Infection 

Reduce notifications 

Hide Mailboxes 

Hide distribution lists 

Perform On-Demand Scan 

Update DAT files 

Down the Exchange Server 




Escalation Time 
Escalate after : 



HJ min(s) 



OK 



Cancel 
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Emergency Response Event 




Specify the name for this event 



Eventl 



Event Summary 



Event Name : 'Number of Identical Attachment types in a Time 
Event Desc : 500 identical attachment types in 1 hours 20 minu 
Reaction to an Emergency is Automatic 
Email Notification is Enabled. Email will be sent to 'ajga.com' 



Automatic Actions 



Step, Action and escalation times 



Update DAT files (0 hr(s) 1 min(s)) 



< Back 



Finish 



Cancel 



] | Help | 
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SpecifyEvent type 
and trigger values 

Specify Re-action type 
Manual or Automatic 
Specify notification types 
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Statistics 

View Outbreak Stats 


Message Counters ^ 
Attachment Counters ► 
Error Counters ► 
Viruses Found 
Average Scan Time 


Performance Monitoring ► 




Enable Triggers ► 
Configure Triggers 
Manual Lockdown 


All Performance Counters 


Configure GroupShield 
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